Slashdot Mirror

← Back to Stories (view on slashdot.org)

Nimda To Strike Again

Posted by ryuzaki0 on from the and-again-and-again dept.

Seabass55 writes: "Researchers say Nimda is set to propagate again after rechecking Nimda's code. God help all the MS boxes ... again." Looks like the owners of unpatched IIS machines have until 9 p.m. GMT (1 a.m. ET) to get ready. I'd like to see a nice double stockade for the writers of Sircam and Nimda, and maybe some fireants. Update: 09/27 22:45 GMT by T : Temporal confusion -- that's 5:00 GMT, sorry :) Update: 09/28 00:14 GMT by T : Carnage4Life contributes this link to a command-line tool from Microsoft to list patches already installed or still needed, if you think your Windows machine may be vulnerable.

31 of 523 comments (clear)

  1. Patch your damn servers! by jiheison · · Score: 5, Funny

    I'd like to see a nice double stockade for the writers of Sircam and Nimda, and maybe some fireants.

    Maybe just corn syrup and regular ants for the admins who still haven't patched their servers.

    1. Re:Patch your damn servers! by Rogerborg · · Score: 4, Funny
      • I'd like to see a nice double stockade for the writers of Sircam and Nimda, and maybe some fireants

      I'd recommend 25 years of indenduted servitude at Microsoft. Possible outcomes:

      • Microsoft learn how to think and code defensively.
      • Microsoft learn that bigger isn't necessarily better.
      • The s'kiddies have the will to code sucked out of them.

      Either way, we win.

      --
      If you were blocking sigs, you wouldn't have to read this.
  2. Not Me by NitsujTPU · · Score: 4, Interesting

    I'd like to see a nice double stockade for the writers of Sircam and Nimda, and maybe some fireants.

    Are you kidding?

    Legislation shows that people have a hard time differentiating what's a serious offence and what isn't.

    For one thing, taking this out on someone hard, would only lead to approval of laws like the proposed law to make a bunch of kids in HS "terrorists" for winnuking each other.

    We KNOW that these aren't hard to create, kids with no formal training can crank them out like they're nothing. To a 14 year old kid who needs to show off to his friends (and almost all of them do), it's IRRESISTABLE. I can't picture throwing someone behind bars for more than a couple years just because they're virus is effective.

    If anything, they need counseling to know WHY what they are doing is bad, that it affects other people and that it isn't just a game, but certainly making an example of these people sets a precident for the treatment of all of us.

    In other words, turn some silly kid with a script for making viruses into a real criminal, when people are getting in trouble for stupid stuff like scanning someone's ports, and soon you'll see anybody without corporate backing thrown in jail for having a debugger.

    1. Re:Not Me by sphealey · · Score: 5, Interesting

      "Legislation shows that people have a hard time differentiating what's a serious offence and what isn't"

      Despite the fact that I thought we were patched and secured, the Nimda worm hit our servers. Oops - missed one of those MS security bulletins. My bad.

      The cost in real dollars (not "gartner dollars" or "TCO dollars) to clean it up was around $25,000. For one small manufacturing company.

      If a naughty kid threw a rock through our window and did $100 of damage, the police would yell at him and call his parents to pick him up. If he threw a bottle of gasoline through the window and did $25k of damage, he would be prosecuted for a felony.

      So exactly how is this Nimda bomb not a "serious offense"?

      sPh

    2. Re:Not Me by ptomblin · · Score: 4, Informative

      but if you have a sysadmin on staff, it's not costing anything real

      Maybe this isn't the case where you work, but where I work people use the computers to get useful work done rather than just to provide employement for a sysadmin. If a virus or worm causes down time, or the DDoS-equivalent of all those scans causes people to be unable to reach the internet to do their jobs, then everybody in the company sits there twiddling their thumbs doing nothing. That costs money. So do lost orders because people attempting to reach your web site get a defacement message and probably a copy of the worm instead of your orders page.

      --
      The next Cmdr Taco duplicate will be ready soon, but subscribers can beat the rush and see it early!
    3. Re:Not Me by technos · · Score: 4, Insightful

      Despite the fact that I thought we were patched and secured, the Nimda worm hit our servers.

      Oops indeed! All of Nimda's exploits were old. You had what? Five months? At a total cost of $25,000?? Damn, I hope you have some money put away, because if you were one of my employees, you'd be working at half pay to reimburse the company for your negligence. That's on a good day. On a bad day, you'd be fired, and I'd call Legal to have them sue your ass once it cleared the doorstep on your way to the unemployment line.

      Rule 1: If you're an NT admin, you have to stay on top of *EVERY* patch. You don't patch, your company loses money because of your negligence. If you don't patch, you deserve to lose your job.

      Now, if you're one of those companies that has lost a lot of 'good men' to rule 1, perhaps you should not use Microsoft products? Perhaps they're not everything the Microsoft rep told you they would be...

      --
      .sig: Now legally binding!
    4. Re:Not Me by Rogerborg · · Score: 5, Insightful
      • If you're an NT admin, you have to stay on top of *EVERY* patch. You don't patch, your company loses money because of your negligence. If you don't patch, you deserve to lose your job

      You apply SP6 to NT4 the day it comes out. Your company's Lotus Notes system falls on its arse. You lose your job.

      Admins have a hard enough job keeping a known, stable system running without applying day-0 patches every time Microsoft figure they're screwed up again. Applying patches immediately and automatically isn't a black and white issue, and all your sound and fury won't make it so.

      --
      If you were blocking sigs, you wouldn't have to read this.
  3. What? by jpinnix · · Score: 4, Funny

    No double stockade and fireants for the IIS creators?

  4. Learn Internet Security Or Get Off The Web! by BIGJIMSLATE · · Score: 5, Informative

    I believe this Wired article applies in this case (as many machines are still left unpatched), as well as an idea of what some ISP's are considering/doing if their subscribers don't have a clue.

    (Plain-text link):
    http://www.wired.com/news/business/0,1367,47037, 00 .html

  5. sircam may me feel warm today though... by edrugtrader · · Score: 5, Funny

    a video game i wrote 10 years ago in Qbasic was just emailed to me today via sircam...

    that means that someone actually had it on their computer, and that made me feel all fuzzy.

    god bless sircam, and its glorious resurrection and distribution of great software titles.

    --
    MARIJUANA, SHROOMS, X: ONLINE?! - E
    1. Re:sircam may me feel warm today though... by BIGJIMSLATE · · Score: 5, Funny

      I had a similar case, but it involved some porn. Now naturally I'd be happy about that under normal circumstances, but not if it's my freaking SISTER!

      EWW.....

    2. Re:sircam may me feel warm today though... by ocie · · Score: 5, Funny

      Yeah, it's good to see that push technology is finally coming to the net :)

      --
      JET Program: see Japan, meet intere
    3. Re:sircam may me feel warm today though... by geekoid · · Score: 5, Funny

      isn't that the wierdest feeling?
      I went to a someone house to find out why there PC was running slow, they had a program I wrote 8 years ago, and they were still using it! I did ask him why he never sent the author the shareware money(10.00). he said "I'm sure he made so much money he won't miss my 10 bucks".
      then I told him it was me, and NO ONE sent me ANY money. boy did we laugh. Of course he still hasn't paid me my 10 bucks...rat bastard.

      --
      The Kruger Dunning explains most post on /. http://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect
  6. Fight back by Anonymous Coward · · Score: 5, Informative

    Check out my script! If you're running Apache, it'll monitor the logfile and send mail to the Administrator of the infected server!

  7. Math? by sharkey · · Score: 5, Interesting

    9pm GMT -04:00 (EDT) is 5pm EDT.
    9pm GMT -05:00 (EST) is 4pm EST.

    However, the time mentioned in the article is 1am ET. Hazard a guess that it is really EDT they are citing, making 5am GMT zero hour. It will be 12:00am (Midnight) EST.

    --

    --
    "Outlook not so good." That magic 8-ball knows everything! I'll ask about Exchange Server next.
  8. Nimda cost me Microsoft. by standards · · Score: 5, Interesting

    My organization was hit hard by Nimda. Our poor Windows Administration staff ran around like crazy cleaning, patching, and upgrading hundreds of machines.

    Is this a Microsoft problem? You bet.

    Microsoft OSs do not have a complete, common set of system administration tools built in. This results in haphazard machine administration.

    Microsoft and other companies sell useful administration tools, but these are high priced tools that only do a piece of the job. And since they aren't included with the OS, very few sysadmins have expertise with them.

    So Microsoft, get on the ball. If you want to sell an OS, it should be ready for the enterprise.... including enterprise administration.

    In the meantime, we're porting our apps from IIS to Apache. Yay!

    1. Re:Nimda cost me Microsoft. by bad-badtz-maru · · Score: 5, Insightful


      Our organization didn't do squat because we spent five minutes researching commonly accepted practices for securing IIS and NT boxes before we ever put our first box on the net. We do the same for every piece of hardware and software, exploits are not an MS-exclusive thing. The simple act of unmapping unused extensions in IIS has saved us countless hours (or days) of agony on many occasions. I suspect your organization may not contain the level of security-conciousness necessary to properly maintain systems connected to the internet since such security-awareness would have included remedial research into the securest method of presenting a piece of hardware or software to the internet. In other words, if your organization knew what they were doing, the issue you experienced would not have occurred. It's not an apache/IIS issue, it's a poor administration issue that will plague your organization, unless corrected, regardless of what OS and web server software they choose to deploy.

      Hope this helps,
      maru
      www.mp3.com/pixal

    2. Re:Nimda cost me Microsoft. by NMerriam · · Score: 4, Insightful

      Our organization didn't do squat because we spent five minutes researching commonly accepted practices for securing IIS and NT boxes before we ever put our first box on the net.

      Unfortunately Nimda spreads itself over shares, too -- so our server was well-maintained, but every shared directory on there was filled with the .dll and .eml files from Nimda that users had been infected on their desktops.

      All it took was a single person on our network who had disabled their antivirus to spread it all over ever network drive in the place.

      --
      Recursive: Adj. See Recursive.
  9. Dangerous Viruses?? by dragons_flight · · Score: 5, Interesting

    Whatever happened to all the "3v1|_ h4x0r5"(TM)??

    We seen a number of highly infectious viruses in the last year (Sircam, Code Red, Nimda, etc), but none of these were actually very destructive. Sure they are a pain to get rid of, and may spread a little information around, eat up bandwidth, or compel you to reformat just to be sure, but they aren't flattening people's systems.

    Whatever happened to the anarchists out to destroy the system? Now admittedly I don't want to encourage people to be more destructive, but it seems almost trivial to think of ways that viruses and worms could easily be made more destructive. For instance, upon infection, delete everything in the "My Documents" folder. Or, change default web page to a share of the whole computer. Or even wait a couple days and then wipe the person's hard drive.

    I haven't been vulnerable to anything to come along lately, and I'm glad, but I'm also glad to note that the truly skilled black hats out there seem to have moderated how much damage they actually intend to do. I wonder if they are scared what the law might do to them if their attack truly was evil.

  10. Terrorists? by Ghoser777 · · Score: 4, Interesting

    Here's what most terrorists do. Atleast this is what I've heard/seen done by past terrorists:
    1. They take hostages
    2. They kill people
    3. They make demands
    4. They invoke terror in their victims

    In no way do these "hackers" fit the description of a terrorist except for maybe #4. These are generally just people who find a whole in security and take advantage of it. They can be really annoying, and people who make these types of viruses should be tried for damages, but I don't think they fit the desciption of a terrorist.

    But more important, I think Ashcroft isn't talking about virys writing hackers, but any type of hacker. Essentially, if you mess with a system at all, then you're a terrorist accroding to Ashcroft.

    Boy, my parents must be disappointed in me now, rasing a terrorist..

    F-bacher

    --
    James Tiberius Kirk: "Spock, the women on your planet are logical. No other planet in the galaxy can make that claim."
  11. If you follow good practice... by drinkypoo · · Score: 5, Informative

    Then you're not vulnerable to either.

    Good practice in this case means keeping your systems updated to the latest patches, not having open shares at all, and updating software to the latest version. It also includes not using software known to be not only a security risk, but basically an open door to "hackers". Note the quotes, please. They indicate sarcasm.

    If you have patched Win2k to SP2, are running IE6 final, and do not use outlook, you have protected yourself from every vector these worms, except for the "Web Folder Traversal" issue. That's a minor quick fix, though it shouldn't have been necessary.

    Why am I willing to specify not using outlook and not specifying not using IIS? Because it became abundantly clear that outlook was unsafe well over a year ago, whereas IIS could have been terms "more or less okay" until recently. Also, you just can't walk away from NT/IIS webservers and jump on the *[iu]x bandwagon right away, because there's all that ASP code lying around.

    Until M$ rewrites outlook, outlook express, and IIS from the ground up, you should immediately (or as close to immediately as you can get) stop using them. Given that IIS sucks anyway, you might as well stop using it permanently. I understand the allure of outlook, and the interoperation between it and exchange, but consider a web-based scheduling/collaboration system. Exchange is pretty lousy anyway, for a whole bunch of reasons I won't bother going into here.

    And finally, this is not anti-microsoft FUD, this is all based on reality. I'm not against microsoft on the desktop, or microsoft servers to serve microsoft clients. But we've seen time and time again how running microsoft windows of any flavor as a web server platform incurs a much higher cost than unix, because unix just doesn't tend to break as often -- Or be compromised. While this is not an OS-level bug, you really only have one choice as far as performance and support goes for a webserver on windows, and it's not a very good choice.

    --
    "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    1. Re:If you follow good practice... by Spy+Hunter · · Score: 5, Funny
      WARNING to IE6 users or people without Outlook installed: You are not invulnerable! A virus file on your system can still easily be excecuted. I recently got infected, and it was the dumbest thing ever. Some time ago I had to reinstall Windows (gdi.exe was corrupted!?!), so I backed my files up to my friend's computer over the network. To get them back I made an open share on my computer (should have had a password) and sent them over. When I was done I noticed that some *.eml files had been inserted into my open share. "Hey, that's the virus I read about on Slashdot," I thought. So I went to delete it. I simply selected the file to delete it (I didn't run it) but Explorer, in its infinite stupidity, ran the file in the preview pane! Simply by the act of selecting the file I had run it inadvertently! This on a system running IE6 without Outlook installed!

      Fortunately I was able to boot into Linux and delete all those .eml files, then download a virus remover from McAfee or someplace. But let this be a warning: Before deleting a .eml file, TURN FILE PREVIEWS OFF!

      --
      main(c,r){for(r=32;r;) printf(++c>31?c=!r--,"\n":c<r?" ":~c&r?" `":" #");}
  12. I am so sick of this by ellem · · Score: 5, Insightful

    I administer Notes, NT, Win9x and a Linux box, plus firewalls yadda, yadda.

    I work in a Corporate Travel Agency in NYC, they just decimated my entire staff and I have me and one other guy who has been relegated to inputting ticket refunds.

    I DON'T HAVE TIME FOR THIS! My lone IIS server has been patched since the first day. Lotus Notes doesn't care about these dumb ass viruses (virii) and my Norton's are all up to date.

    My USERS got this crap from infected web pages!

    We're losing a machine a day in the field b/c these bozos can't figure out how to click on a button called VIRUS_FIX on the corporate intranet.

    I am ready to frigging quit and become an English Teacher fuck the money! If the whole MS world can be brought to its knees everytime some kid in Sweden has the day off then we're all fucked.

    CIOs who continue to use Outlook/IIS deserve whatever happens to them. (We HAD to use IIS for a 3rd party software app.) Micorsoft SHOULD ABSOLUTELY BE PAYING IT'S CUSTOMERS BACK FOR THIS! HOW DARE THEY GET READY TO RELEASE YET ANOTHER VIRUS RUNTIME OS.

    It is seriously time for the MCSE farms to be shut down and for corporate America to move to another OS. Fuck the users; guess what they don't know all that much about the OS they are on switching them now will have no lasting impact.

    --
    This .sig is fake but accurate.
  13. Re:SysAdmins....wake up by Roofus · · Score: 5, Informative

    Heh, I work with a guy who isn't the brightest at times. He's been setting up a 2000 Server that's been hit twice with nimda in the last week. He reinstalled the server from scratch after each infection. His response?

    "I put the computer on the network to install Norton, and it keeps getting infected before I can get the updates"

    Ok, TWO THINGS:

    1) If your going to install IIS, do not plug it into the network you've shut down IIS. Then go download the updates.

    2) Norton isn't going to stop you from getting infected, it will only warn you about it during a routine check. If you want your machine to stay healthy, PATCH YOUR GODDAMN SYSTEM.

    Seriously, Microsoft has a little utily called HFNetChk that will scan any local or remote system and will tell you what patches need to be applied. This includes system, IIS, and SQL Server, and IE.

    Not all updates are listed on the little automatic update website.

    Sigh...

  14. Read between Gartner's lines by alienmole · · Score: 5, Insightful
    Did you read the Gartner report carefully? It said "enterprises hit by both Code Red and Nimda" should investigate alternatives. This implies that enterprises not hit by both worms don't need to switch.

    If a company wasn't hit by both, presumably their security policies and procedures are either already up to scratch, or capable of being improved sufficiently. But if a company was hit by both, their procedures are probably beyond repair, and they'd be better off with a server that's more secure by default.

    So I think Gartner was absolutely correct. Not only that, but people who didn't pick up that subtlety from the Gartner report are also more likely to need to switch servers, so the report works either way! :P

  15. Re:Serves You Right. by SuiteSisterMary · · Score: 4, Insightful

    I'll point out that a firewall won't protect from this, as these are legitimate http requests. Your gateway anti-virus solution and/or intrusion detection system, on the other hand, should catch these. But this sort of thing is NOT what a firewall is supposed to stop.

    --
    Vintage computer games and RPG books available. Email me if you're interested.
  16. Don't want the attacks clogging up your logs? by rayvd · · Score: 5, Informative

    If you run Apache and hate looking at the hundreds of annoying attacks by the Code Red and Nimda worms, try adding these to your httpd.conf:

    SetEnvIf Request_URI "^/default.ida" attacks # For Code Red
    SetEnvIf Request_URI "^/scripts" attacks # For nimda
    SetEnvIf Request_URI "^/c/winnt" attacks # ... ditto all the way down
    SetEnvIf Request_URI "^/_mem_bin" attacks
    SetEnvIf Request_URI "^/_vti_bin" attacks
    SetEnvIf Request_URI "^/MSADC" attacks
    SetEnvIf Request_URI "^/msadc" attacks
    SetEnvIf Request_URI "^/d/winnt" attacks

    CustomLog /var/log/access_log combined env=!attacks
    CustomLog /var/log/attack_log combined env=attacks

    This will dump all the "attacks" into a file called attack_log and leave your normal logfile clutter free.

  17. Nimda is a tough worm to keep out of a network! by Nonesuch · · Score: 4, Informative
    Nimda is complicated beast.

    Unlike 'Code Red', Nimda does not spread by pushing the worm binary in the HTTP request. The worm uses HTTP to find a vulnerable IIS server, then causes the IIS server to make a TFTP request out to the attacking host to retrieve the ~64K binary.

    Most normal 'secure firewall' products aren't tuned to block outbound requests from the protected servers to internet hosts. Mine are, but that only gave me about 72 hours of lead time before it came in another way...

    Even when firewalls block the IIS scanning, Nimda spreads by email, file shares, and by putting a copy of 'README.EXE' in the root of the IIS server and adding Javascript to all web pages on the server, pushing the worm at users of the infected web site server.

    My firewalls block _all_ UDP packets, but my network still got hit hard, and probably incurred more like $60K in 'paper losses' -- lost productivity, bandwidth, overtime, etc.

    We haven't found 'patient zero', but we have two good suspects, in both cases a user with a laptop that did not have updated anti-virus software and that got infected from one of these routes:

    1. User took the laptop home and connected to an infected network/file shares.
    2. User accessed 'hotmail' or a similar site and downloaded an attachment.
    3. User visited an infected web site (probably at home) and ran README.EXE when prompted.

    The common thread here is user error.

    The best firewall is no protection against malicious, or just plain ignorant, users. Blame also falls on local admins for failing to push virus signature updates and keep up with system patches.

    I've only ever seen around a dozen inside hosts from which the work was actively scanning HTTP, but the worm traffic from those dozen machines alone was enough to severely degrade WAN and firewall performance.

    --

    I do not deploy Linux. Ever.
  18. Re:Windows Update?! by Meorah · · Score: 4, Informative

    Ehh. You can't judge a book by its cover. "Windows Update" will not supply hot-fixes for security updates. These are combined with all the other new features, bug fixes, and security fixes in a SERVICE PACK. You can definitely get all your service packs from Windows Update, but you'll have to wait for them to actually come out. This is obviously unacceptable, which is why MS started releasing separate hot-fixes for any security flaws that simply had to be implemented immediately, and couldn't wait on any service packs.

    You might also want to read the directions for the tool you are using before jumping to conclusions about what the "WARNING" means. Read the security bulletin, and try to figure out why they made it stand out from all the other patches.

    So, in summary... MS used to release Service Packs for fixes/updates/additions/bloat/etc. Although this is adequate for non-life-threatening issues, it has quickly become inadequate for security. MS releases a free tool to be used AS A SUPPLEMENT to Windows Update, which will allow you to apply each new security hot-fix as they release them, instead of being forced to wait on the next Service Pack.

    "CRITICAL UPDATES" are where Service Packs are placed. Those 8 hot-fixes are part of SP3, but you can download them now since they relate to security making your system vulnerable to certain viruses and trojans.

    With the increasing awareness of security, I'm surprised that you assumed anything, when you could have taken 10-15 minutes on MS's site to find out how clueless you were.

    --
    Protector of Capitalist views,
    Meorah
  19. Re:SysAdmins....wake up by Judg3 · · Score: 4, Informative

    Agreed, HFNetchk essentially looks for Registry keys that state which patches are installed. If you use it, always use the '-z' switch, which tells it to not look for the registry entries. This makes it take a little longer, because it searches for actual files, but it's ALOT more accurate.
    Also, eEye has a neat little NIMDA Scanner which will do up to a Class B net looking for exploitable machines. Sometimes finding a machine that COULD be infected is harder then finding the actual infected ones.
    URLScan is nice, but you really need to know what your doing to run it, as it's easy to mess up a webserver thats running fine.
    But the most important thing to do is to get on those security lists, NTBugtraq, MS security lists, etc. As well as hitting the big security related sites out there before your morning cup of coffee to make sure nothing new has come up.

    It's all basically common sense, but every now and then you need a nice reminder.

    --
    Looking for hardware (Currently need: Large Etch-a-Sketch) Have one? See my journal!
  20. Here's how I'm getting them patched by DrSkwid · · Score: 5, Funny

    I've gone through my logs and found quite a few

    What I do is go connect to the offending box via smb

    Usually they have a printer attached to it so I print out a page of A4 with :
    "YOU ARE INFECTED WITH NIMDA, SORT IT OUT
    here's how : http://www.antivirus.com"

    on it in 72 point text

    it's working so far

    if they don't have a printer then they usually have an open share that's world writable so I leave text files called

    you are infected with nimda.txt

    and put the url inside them

    that's closed a couple too

    (I also found a keygen I'd been looking for so that was a bonus)

    I'm not sure if nimda resets the passwords but which might not lead to a surprise of how far you can go with

    un : adminsitrator
    pw :

    have fun

    --
    There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter